SecurityScan

securityscan-api/securityscan-api

Scans GitHub-hosted AI skills for security issues before your agent installs them. Exposes three MCP tools: scan_skill submits a repo URL and returns a scored report flagging prompt injection patterns, malware indicators, and OWASP LLM Top 10 violations with line numbers and snippets. Get_report retrieves cached public scan results at no cost. Check_certification validates skill safety badges. Useful when building agents that autonomously install third-party skills and need supply chain verification without human review. Free tier gives you 5 scans per month. Results include a verdict (SAFE, CAUTION, DANGEROUS) based on a 0-100 score, plus detailed issue breakdowns. Average scan completes in under 3 seconds. Connects to https://apisecurityscan.net/mcp via streamable HTTP.

tools: 8
auth: Secret needed
transport: HTTP
last updated: Mar 2, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://apisecurityscan.net/mcp --name securityscan --header 'X-API-Key: ${X_API_KEY}'

Run in your terminal. add-mcp asks which agents to add it to, then asks for each value it needs. Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http securityscan https://apisecurityscan.net/mcp --header 'X-API-Key: YOUR_X_API_KEY'

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 8 tools

Verified live against the running server on Nov 6, 2026.

scan_skillAnalyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).1 params

Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).

Parameters* required

skill_url*string

URL of the skill to analyze (e.g. a GitHub skill URL).

check_dependenciesCheck the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).1 params

Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).

Parameters* required

endpoints*array

List of URLs your agent/skill depends on, e.g. ["https://api.openai.com", "https://api.stripe.com"]

network_scanActive security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.3 params

Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.

Parameters* required

authorized*boolean

REQUIRED. You must set this to True to certify that you own the target or have explicit permission to test it. Setting it to False (or omitting it) aborts the scan. Scanning without...

scan_typestring

"quick" (~30s, top ports) [default], "standard" (~2min, agent loop), "deep" (~10min, full ports + credentials check)default: quick

target*string

IP, CIDR, or hostname. Examples: "192.168.1.1", "10.0.0.0/24"

audit_mcp_server_configAudit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability co...1 params

Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability co...

Parameters* required

config_json*string

The FULL JSON content of the MCP config file as a string (e.g. claude_desktop_config.json or .mcp.json). Paste the file content, not the path.

scan_secretsScan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API...2 params

Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API...

Parameters* required

redactboolean

If True (default), each match is replaced with a token like [REDACTED-KEY] / [REDACTED-EMAIL]. If False, only reports.default: true

text*string

The payload to inspect (prompt, request body, document text).

full_stack_auditComplete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. P...6 params

Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. P...

Parameters* required

dependency_endpointsvalue

URLs your stack depends on (optional)

mcp_config_jsonstring

MCP config content as string (optional)default:

network_authorizedboolean

REQUIRED to scan network_target. Set True to certify you own or have permission to scan it. (optional, default False)default: false

network_targetstring

IP to scan, e.g. "192.168.1.1" (optional)default:

skill_urlstring

untrusted skill to vet (optional)default:

text_to_scanstring

payload to vet for secret/PII egress (optional)default:

securityscan_pricingSecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the prici...

SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the prici...

No parameters. Call it with no arguments.

securityscan_checkoutStart a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.3 params

Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.

Parameters* required

emailstring

optional — prefills the Stripe checkout page for your userdefault:

existing_keystring

optional — upgrade an existing ask_live_ key instead of minting a new onedefault:

tier*string

one of "founder" ($29 one-time), "personal", "executive", "enterprise" (monthly)

Readme

Details

Repository: github.com/securityscan-api/securityscan-api
Website: apisecurityscan.net
Categories: AI & LLM Tools, Developer Tools, Security & Pentesting
Transport: HTTP
Auth: Required
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related AI & LLM Tools MCP servers

View all

Nexus Mcpnexus-api-lab/nexus-mcpJapanese LLM security — prompt injection detection (jpi-guard) + PII masking (PII Guard). Free.0stars

AgentWatchnicofains1/agentwatchMulti-agent observability: cascade failure detection, heartbeats, and forensic replay0stars

Roundtabledeadpixel/roundtable-dashboardMulti-model AI debates: GPT-4o, Claude, Gemini & 200+ models discuss, then synthesize insight.0stars

Mcp Bookmarkpree-dew/mcp-bookmarkMCP Server for adding bookmarks in openai RAG0stars

Psyseal scanpsyseal/psyseal-scanOffline check of your AI agent: heartbeat cost, plaintext keys, planted or bloated memory.0stars

Robinhood (Agentic Trading)robinhoodOfficial Robinhood MCP server for agentic trading. Connect any AI agent to a dedicated, sandboxed Agentic account: it can read your accounts, positions, and ord0stars